I have an index=logs that has an ip_address field like 126.96.36.199
I want to correlate it against a csv file that has list of ip ranges to see owner. first field contains range beginning and second is range end. so in case of 188.8.131.52, it should match with csv file below
Is there a way to lookup csv ip ranges and join on ip_address field in index=logs? Also, if csv file contained IP range in CIDR format instead, would this be a better way to lookup against?
184.108.40.206 220.127.116.11 Owner1
18.104.22.168 22.214.171.124 Owner2
For lookups to use CIDR the address column in your lookup must be in CIDR notation. And you need to define the field as a CIDR lookup as in this answers post.